TA0011 · COMMAND AND CONTROL
Remote Access Tools
AnyDesk, TeamViewer, ScreenConnect, and similar tools installed by the adversary as their C2.
Detect it with
RMM binaries on hosts outside IT's approved inventory; traffic to RMM vendor domains from unmanaged endpoints.
Why it matters on shift
Remote Access Tools is one of the concrete ways adversaries achieve command and control. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After command and control, the next tactic is usually Exfiltration. Search your telemetry for the transition before closing the ticket.
3 sub-techniques
How it shows up in practice
- T1219.001
IDE Tunneling
Adversaries may abuse Integrated Development Environment (IDE) software with remote development features to establish an interactive command and control channel on target systems within a network.
- T1219.002
Remote Desktop Software
An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks.
- T1219.003
Remote Access Hardware
An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks.
Kill-chain context